Skip to content

Hide Navigation Hide TOC

AWS EC2 Startup Shell Script Change (1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df)

Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up.

Cluster A Galaxy A Cluster B Galaxy B Level
AWS EC2 Startup Shell Script Change (1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df) Sigma-Rules PowerShell - T1059.001 (970a3432-3237-47ad-bcca-7d8cbb217736) Attack Pattern 1
AWS EC2 Startup Shell Script Change (1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df) Sigma-Rules Windows Command Shell - T1059.003 (d1fcf083-a721-4223-aedf-bf8960798d62) Attack Pattern 1
AWS EC2 Startup Shell Script Change (1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df) Sigma-Rules Unix Shell - T1059.004 (a9d4b653-6915-42af-98b2-5758c4ceee56) Attack Pattern 1
PowerShell - T1059.001 (970a3432-3237-47ad-bcca-7d8cbb217736) Attack Pattern Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830) Attack Pattern 2
Windows Command Shell - T1059.003 (d1fcf083-a721-4223-aedf-bf8960798d62) Attack Pattern Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830) Attack Pattern 2
Unix Shell - T1059.004 (a9d4b653-6915-42af-98b2-5758c4ceee56) Attack Pattern Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830) Attack Pattern 2